From b16cd5e96f7b1a2391949a32189cda5a347be452 Mon Sep 17 00:00:00 2001 From: Leopoldadmin Date: Mon, 20 Jul 2026 23:13:47 +0000 Subject: [PATCH] Fix Bug 5: require groups:read permission for list_groups --- app/routes/groups.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/routes/groups.py b/app/routes/groups.py index fe84d7d..2d9d010 100644 --- a/app/routes/groups.py +++ b/app/routes/groups.py @@ -21,7 +21,7 @@ router = APIRouter(prefix="/api/v1/groups", tags=["groups"]) @router.get("") async def list_groups( db: AsyncSession = Depends(get_db), - current_user: dict = Depends(get_current_user), + current_user: dict = Depends(require_permission("groups:read")), ): """List all groups in the current tenant.""" import uuid as _uuid